Merge remote-tracking branch 'qatar/master'

* qatar/master:
  mpc8: check output buffer size before decoding
  mpc7: return error if packet is too small.
  mpc7: check output buffer size before decoding
  nellymoserdec: allocate float_buf only when decoding to int16
  nellymoserdec: use NELLY_BUF_LEN instead of 128
  nellymoserdec: use NELLY_BLOCK_LEN instead of 64 when appropriate.
  nellymoserdec: allow user to request SAMPLE_FMT_FLT for output samples.
  nellymoser: check output buffer size before decoding
  win32: improve threading algorithm warning

Conflicts:
	libavcodec/nellymoserdec.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 9 insertions, 2 deletions

diff --git a/libavcodec/mpc7.c b/libavcodec/mpc7.c
index ba8828eb52..272e1b28ba 100644
--- a/libavcodec/mpc7.c
+++ b/libavcodec/mpc7.c
@@ -197,12 +197,19 @@ static int mpc7_decode_frame(AVCodecContext * avctx,
     int i, ch;
     int mb = -1;
     Band *bands = c->bands;
-    int off;
+    int off, out_size;
     int bits_used, bits_avail;
 
     memset(bands, 0, sizeof(bands));
     if(buf_size <= 4){
         av_log(avctx, AV_LOG_ERROR, "Too small buffer passed (%i bytes)\n", buf_size);
+        return AVERROR(EINVAL);
+    }
+
+    out_size = (buf[1] ? c->lastframelen : MPC_FRAME_SIZE) * 4;
+    if (*data_size < out_size) {
+        av_log(avctx, AV_LOG_ERROR, "Output buffer is too small\n");
+        return AVERROR(EINVAL);
     }
 
     bits = av_malloc(((buf_size - 1) & ~3) + FF_INPUT_BUFFER_PADDING_SIZE);
@@ -277,7 +284,7 @@ static int mpc7_decode_frame(AVCodecContext * avctx,
         *data_size = 0;
         return buf_size;
     }
-    *data_size = (buf[1] ? c->lastframelen : MPC_FRAME_SIZE) * 4;
+    *data_size = out_size;
 
     return buf_size;
 }